English Convenience Translation
MITHAQ Privacy Policy
This English version is provided for convenience only. The Hebrew version is the binding version and prevails in any conflict or ambiguity.
MITHAQ Online Services Ltd. | Co. No. 517351250
Last updated: 25 October 2026 | Version 11
1. Who We Are and Where This Policy Applies
The controller of personal data within the Service is MITHAQ Online Services Ltd., Co. No. 517351250, a company registered in Israel (the “Company”).
This Policy applies to the MITHAQ application, website, landing pages, support services, payment services, photo verification services and any other service operating under the MITHAQ brand.
This Policy forms an integral part of the Terms of Use and explains how data is used. Providing personal data is voluntary, unless a legal obligation applies and is brought to your attention. Without information needed for account creation, verification or an action you request, we may be unable to provide it. Merely viewing the website or accepting the Terms does not replace any separate consent required for sensitive data, location, contacts, marketing or photo verification.
Privacy inquiries: support@mithaq-connect.com.
2. What Data We Collect
We collect information you provide, information generated during use, information from service providers and external information you choose to connect, according to the actions and features used. Listing an optional feature in the table does not mean it is available in every version and does not authorize collecting data for it without the required notice and permission.
| Data type | Examples | Notes |
|---|---|---|
| Account details | Name, phone number, email address, date of birth, authentication data (one-time SMS code) and account identifier. | Fields required for account creation or verification will be identified on the relevant screen; not providing them may prevent the requested action. |
| Profile details | Gender, age, photos, city/region, family status, children, education, occupation, self-description, lifestyle, preferences and answers to compatibility questions. | Some information may be sensitive or particularly personal. |
| Sensitive data | Religion/religious lifestyle, values, family status, children, dating preferences and information that may reveal beliefs or personal characteristics. | Processed only according to law and with appropriate consent. |
| User content | Photos, text, messages, chats, reports, responses and support inquiries. | Retained to operate the Service, protect safety and enforce the Terms. |
| Purchase data | Credit package, price, purchase date, payment status, refunds and an invoice/receipt if issued. | Full card details are processed by the payment provider and are not stored by us. |
| Usage data | Logins, views, matches, rejections/approvals, contact requests, credit usage, blocks, reports, duration of use and frequency of activity. | Used for Service operation, matching, safety and improvement. |
| Technical data | IP address, device type, operating system, app version, device identifiers, interface language, crash data and logs. | Required for security, support, troubleshooting and fraud prevention. |
| Location | City/region and approximate distance. When you tap "Use my current location" and grant location permission, device coordinates are sent to our server to identify a nearby locality. The selected locality is stored in your profile; an approximate location may be temporarily retained on your device to rank suggested localities. Precise coordinates are not saved as a profile field. | Location permission may be revoked in device settings, but some services may be affected. |
| Contacts for blocking (mutual hiding from your contacts) | This feature is optional and off by default. It is turned on only after an explanatory screen and your consent; only then does the app ask for permission to access your phone's contacts. Only Israeli mobile numbers are sent from your device — never names or any other contact details. On our server, each number is converted into a keyed hash (HMAC, using a secret key held on the server), and only the hash is stored; the number itself is not kept. | The hashes are used only to make sure that you and the people saved in your phone do not see each other's profiles. They may include hashes of numbers of people who are not MITHAQ users; we never contact or invite them. Turning the feature off deletes the stored hashes, and deleting your account also deletes them. A person who is not a user can ask support@mithaq-connect.com to remove the hash of their number. |
| Optional photo verification | Selfie, comparison photo, verification result, check identifier and related technical data. If an external provider generates facial/biometric data, this will be disclosed before use. | Verification is optional and paid if offered, except in exceptional cases of suspected safety risk or fraud. |
| Marketing and surveys | Participation in a survey, campaign, promotion, focus group or marketing inquiry. | Direct marketing follows consent and applicable law. |
3. Why We Use Data
| Purpose | Data types | Conditions and limits on use |
|---|---|---|
| Account creation, verification and login permissions | Account, phone, email, technical | Details provided for registration or use you request, after notice; additional identification requirements only where justified by law or Service safety. |
| Matching model and profile display | Profile, preferences, general location, usage, insights | According to information and preferences you provide; appropriate consent for particularly sensitive data and location permissions where required. |
| Daily suggestions, contact approval, profile unlocking and gradual exposure | Profile, usage, matches, credits | According to Service actions, approvals and exposure settings; this does not authorize external publication of a profile. |
| Credits, payments and refunds | Purchase, account, usage, technical | For the purchase, action or refund request; supporting records retained according to legal obligations. |
| Optional paid photo verification | Photos, selfie, verification result, technical data | Only after verification details are provided and the required consent is obtained, as set out in section 4. |
| Blocking contacts and users | Contacts, account, profile, usage | At the user’s choice; access to contacts only with appropriate permission and for blocking purposes. |
| Safety, fraud prevention, enforcement and reports | All data types as needed | Only data relevant to the risk or incident, for the purposes described and to the extent permitted by law. |
| Customer service and support | Account, purchase, inquiry content, logs | To address an inquiry or fault, with access limited to necessary information. |
| Service improvement, research and statistics | Usage, insights, aggregated or minimized data | Only for the purposes described, using minimized data where possible; processing requiring consent takes place only after consent. |
| Direct marketing | Account, usage | According to required consents and permissions; accepting the Terms alone does not constitute consent to marketing messages. |
| Legal compliance and disputes | Purchase, support, logs, reports and all relevant data | To the extent required for a legal obligation, a specific proceeding or protecting rights, subject to law. |
We will not make decisions that have legal or similarly material effect on you based solely on automated processing without the possibility of human review, where required by law.
4. Sensitive Data and Consents
Due to the nature of the Service, some information may be particularly personal or sensitive, including religion/religious lifestyle, family status, children, dating preferences, photos, location and photo verification data. Providing such data is voluntary, but certain features may not operate without information required for them.
Where separate or explicit consent is required, the relevant processing will not take place before a clear explanation is provided and consent obtained. You may request withdrawal of consent by contacting support@mithaq-connect.com, manage device permissions in device settings and use additional privacy controls where available in the application. Withdrawal may disable a dependent feature and does not remove a legal retention obligation applicable to data already collected.
Photo verification is optional and paid if offered, subject to the safety-verification cases described in the Terms. Activating verification involving a selfie, facial comparison or biometric data is conditional on explaining, before collection: the data collected, the processing provider, whether facial/biometric data is generated or stored, the purpose, retention period and deletion process, and the implications of refusing or failing verification. This information and required consent cannot be replaced by general acceptance of this Policy; a safety need does not override legal requirements.
5. What Is Displayed to Other Users
To operate the Service, certain profile information will be displayed to other users according to the Service structure, privacy settings, filters and approval stages.
First name/nickname, age, city/region, photos, self-description, family status, children, lifestyle and answers to compatibility questions may be displayed.
Some information may be displayed in a blurred, partial or gradual way until contact approval or use of a credit, according to the Service model.
Phone numbers, email addresses, payment details and technical identifiers provided as account details are not displayed to other users as profile fields. Information you choose to publish in profile text or send in a conversation may be visible to the recipient; do not share information you do not wish to disclose.
Messages and chats are visible to the other party to the conversation. Chat messages are end-to-end encrypted on users’ devices, and we cannot read their content; our chat provider stores them only in encrypted form, together with the technical data needed to deliver them (such as sender and time). When you report a user, we receive only the reason you select and any description you choose to write; chat messages are not attached to the report.
If you use contact blocking, we will use the information required to reduce the chance of mutual display with those contacts, but we do not guarantee complete blocking in every technical situation.
6. With Whom We Share Data
We do not sell personal data to third parties. We share data only to the extent required for the purposes described in this Policy and subject to law.
Other users - profile information and content you chose to share, according to the exposure model.
Cloud and hosting providers - Supabase for the database and authentication; DigitalOcean Spaces for photo storage; and Stream for chat services, to operate the Service.
SMS/OTP and email providers - for verification, security and service messages.
Payment providers and app stores - for billing, invoices, refunds and fraud prevention.
Tranzila / Interspace Ltd. (אינטרספייס בע"מ) — an Israeli payment processor and payment-data processor for website purchases by card, Google Pay or Apple Pay; Bit is not offered.
Photo/identity verification providers - if you choose to use photo verification or if verification is required due to safety concerns.
Analytics, logging and crash providers - to fix errors, measure usage and improve the Service. Data sent to these providers may include a persistent account identifier and technical data; such an identifier is not anonymous.
Professional advisers - legal, accounting, information security and customer support, as needed.
Competent authorities and courts - if there is a legal obligation, order, lawful request or need to protect rights, safety or prevent an offense.
Corporate transaction - in case of merger, acquisition, investment, restructuring or sale of activity, subject to appropriate privacy commitments.
We require service providers that process personal data on our behalf to protect it to a standard no lower than that described in this Policy, use it for the agreed Service purposes, and assist in fulfilling deletion requests, subject to the retention exceptions set out in this Policy and applicable law.
Beyond the limited sharing with other users, providers and parties described in this section, we will not disclose to third parties the fact that you are a user of the Service in a way that identifies you personally, unless you gave explicit consent or the disclosure is required by law.
Website payments through Tranzila
Payment details are entered directly in the secure payment window (iFrame) of Tranzila / Interspace Ltd. (אינטרספייס בע"מ), an Israeli payment processor. To issue a tax invoice-receipt and email it to you, MITHAQ passes your first name and the verified email address on your account to Tranzila; if your account has no verified email, the payment page may ask for one. Tranzila processes card or wallet-payment details, the name and email, and transaction data for payment processing, payment verification, invoicing, refunds and fraud prevention. MITHAQ does not receive or store full card numbers or card security codes. MITHAQ’s website-payment record contains only the order ID, amount, status and Tranzila transaction reference.
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Tranzila / Interspace Ltd. (אינטרספייס בע"מ) | Payment processing and payment-data processing for charges, refunds and invoices | Card or wallet-payment details entered in its window; first name and verified email we pass for the invoice (or entered in its window); transaction data | Israel (and Tranzila’s subprocessors under its agreement) |
7. Cross-Border Data Transfers
Some service providers may store or process data outside Israel, including in the United States, the European Union or other countries. Cross-border transfers will be made according to the Israeli Privacy Protection Regulations (Transfer of Data Abroad), 5761-2001, and appropriate safeguards such as transfer to a country with adequate protection, appropriate contractual commitments, user consent or another mechanism permitted by law.
8. Data Retention and Deletion
We retain personal data only while needed for the purposes stated in this Policy: operating the Service you request, legal obligations, payments and disputes, security, fraud prevention and user safety. Retention is determined by the data type, account activity, retention purpose, legal obligations, any open inquiry or proceeding and the specific risk. Continued retention needs will be reviewed periodically; these provisions do not authorize indefinite retention or retaining all data merely for convenience.
Account and data deletion request: contact support@mithaq-connect.com with the subject “MITHAQ account deletion” and provide the phone number or email address linked to the account. You can also delete your account in the app at any time: on the Profile tab, tap “Delete account” and confirm by typing DELETE. Reinstalling the app is not required to submit an email request. To prevent deletion by another person, we will request only reasonable information needed to verify the request; do not send a login code or full card details.
After receiving and verifying a deletion request, we will act to remove the profile from active display and complete data deletion without unreasonable delay and within applicable legal deadlines. Once account deletion is completed, the profile will no longer appear as active. Data no longer needed will be deleted or anonymized so that identification by reasonable means is not possible; certain data may be retained on a limited basis for the purposes below. We will confirm completion; if some data cannot be deleted, we will explain its categories, retention purpose and period or the criteria determining it, where legally permitted.
Data retained after account deletion will be kept in a minimized form where possible and only for the purpose for which retention is required. For example, transaction data may be retained for tax and accounting purposes; consent records may be retained to evidence compliance; report, block and violation data may be retained to prevent re-registration or harm to users; technical logs and backups will be deleted or overwritten according to reasonable retention cycles.
The Company cannot delete copies another user has saved outside its systems. Conversation, report or support data remaining within Company systems after deletion is subject to the same purpose, access and retention limits in this section and will not be used to display an active profile. Prior disclosure to another user does not authorize the Company to retain data without need or indefinitely.
Where an account is blocked for a breach, harassment, impersonation, suspected fraud or a safety risk, minimum data needed to prevent re-registration and address the risk may be retained. Its scope and retention period will be limited to that purpose and reviewed according to the circumstances; a block is not a reason to retain all account content indefinitely.
| Data type | Retention-period criteria | Limits and explanations |
|---|---|---|
| Profile and photos | While the account is active and data is needed for the Service, and until a deletion request is processed. | After account deletion is completed, the profile is not displayed as active; only data needed for a specific retention exception is retained. |
| Chats and matches | While needed to provide the Service. When the account is deleted, chat messages, which are stored only in encrypted form, are deleted from the chat service; match data is kept after deletion only for a justified period for a report, dispute, safety issue or legal obligation. | There is no automatic retention period for all chats. Data must be minimized and continued retention needs reviewed. |
| Purchase and accounting data | For the period required by tax and accounting law and any relevant proceeding or dispute. | Transaction records may remain after deletion without retaining an active profile for this purpose. |
| Support and report records | Until handling is completed, and then only while necessary for a legal obligation, safety or defense concerning a dispute. | The incident type and risk must be considered; inquiries must not be kept without a defined purpose. |
| Block and violation data | For a period appropriate to the risk of misuse, re-registration or harm to users. | Only the minimum needed is retained, subject to review; not all content merely because an account was blocked. |
| Logs and technical data | According to security, troubleshooting and legal requirements applicable to the log type. | Purpose-limited retention and deletion cycles; longer retention only for a defined need such as an incident under review or legal obligation. |
| Consent records | While needed to demonstrate consent, withdrawal and legal compliance or a relevant dispute. | For example: consent date, notice version and permission type; not all account content. |
| Photo verification data | According to the data type and the specific period disclosed before verification is activated, subject to law. | Original photos, facial data if generated and verification results must be distinguished. This section does not authorize unnecessary additional retention. |
| Backups | Until deletion or replacement within a defined, limited backup cycle, unless a specific legal retention obligation applies. | Copies temporarily remaining in backups are not used for active display or marketing. Completed deletion requests must be reapplied following restoration. |
9. User Rights
Rights of access to and correction of personal data are available under the Israeli Privacy Protection Law, subject to its conditions and exceptions. The requests below may also be submitted under applicable law and the arrangements in this Policy. An account deletion request does not override legal retention obligations, and this Policy does not state that every request creates an unconditional right to deletion of all data.
Access - receive information about data held about you or a copy of it, subject to identity verification.
Correction - request correction of inaccurate, incomplete or outdated information.
Deletion - request deletion of an account and data under section 8 and applicable legal rights, subject to defined, proportionate retention exceptions.
Withdrawal of consent - withdraw consent for certain processing such as location, marketing, contacts or sensitive data, where processing is based on consent.
Marketing opt-out - unsubscribe from marketing communications at any time.
Automated decision inquiry - request human review where required by law.
Complaint - contact us and, if unsatisfied, the Israeli Privacy Protection Authority.
To exercise rights, contact support@mithaq-connect.com and include sufficient identifying details to verify the request. We will respond within the time required by law or within a reasonable time where no specific period is set. We may reject a request if we cannot verify the requester’s identity, if the request harms another user’s privacy, if there is a legal obligation to retain data or if another legal exception applies.
Users outside Israel: The Service is operated by an Israeli company and is intended primarily for users in Israel. If a user is located outside Israel when using the Service, mandatory privacy or data protection rights under applicable local law may apply only to the extent such law applies to the Company or to the processing of personal data under its own provisions. Nothing in this Privacy Policy constitutes the Company's voluntary submission to any foreign law, or grants jurisdiction outside Israel, except to the extent required by mandatory law. Privacy rights inquiries may be sent to: support@mithaq-connect.com.
10. Cookies, SDKs and Similar Technologies
The Service may use cookies, SDKs, device identifiers and similar technologies for operation, security, login persistence, fraud prevention and usage analysis where permitted by law.
Essential cookies - required to operate and secure the Service.
Analytics cookies/SDKs - to measure performance, fix issues and improve user experience.
Advertising - the MITHAQ app does not display ads, does not use advertising identifiers (IDFA/AAID) or advertising SDKs, and does not track users across other companies’ apps or websites.
Certain permissions may be managed through device, browser or application settings. Blocking essential components may impair the Service.
11. Data Security and Database Management
The Company is required to take technical and organizational security measures under the Israeli Privacy Protection Regulations (Data Security), 5777-2017, the Privacy Protection Law and applicable Privacy Protection Authority guidance, according to the data characteristics and risk level. Security and management principles include:
Encryption in transit and, where possible, at rest.
Access permissions on a need-to-know basis only.
Vendor management and data processing agreements.
Activity records and logs for security purposes.
Periodic security tests and incident response.
Employee training and confidentiality procedures.
Mapping of databases, processing purposes, authorized personnel and providers.
Compliance with registration, notice or privacy role appointment duties as required by law.
Absolute security cannot be guaranteed. In the event of a material security incident, the Company will act according to law, including investigation, damage mitigation, documentation and notification to the Authority or users where required.
12. Minors
The Service is intended for users aged 18 or older only. We do not allow minors to use it or knowingly collect their data. If a registered user is found to be a minor, we will act to remove the account and delete the data, except for minimum information that must or may lawfully be retained to address the incident and protect minors. Reports may be sent to support@mithaq-connect.com. Standards against child sexual abuse and exploitation are set out in section 9.1 of the Terms of Use.
13. Changes to this Policy
The Company may update this Policy from time to time, including due to legal changes, product changes, new providers, payment mechanisms, verification or advertising. A material change will be published in the application or sent to users before it takes effect, where required by law.
14. Contact and Complaints
Privacy inquiries, access requests, correction, deletion, withdrawal of consent or complaints: support@mithaq-connect.com.
Legal or consumer inquiries: support@mithaq-connect.com.
Company: MITHAQ Online Services Ltd., Co. No. 517351250.
If you are unsatisfied with how your inquiry was handled, you may contact the Israeli Privacy Protection Authority at the Ministry of Justice, according to the contact details published on the Authority’s website.